dominohub[.]jp[.]99[.]com

The domain dominohub.jp.99.com has been identified as a generic phishing threat. Analysis indicates no direct brand impersonation, but the infrastructure and content are consistent with fraudulent credential harvesting or malicious redirection schemes. The domain is currently offline, though prior activity suggests it was actively used in phishing campaigns targeting unsuspecting users. Infrastructure analysis reveals the domain was registered on February 24, 2026, through Xin Net Technology Corporation, a registrar frequently associated with high-risk domains. It resolves to the IP address 3.160.150.3, hosted on Amazon Web Services infrastructure, and employs technologies such as WebAssembly, Nginx, and Amazon CloudFront. The SSL certificate is issued by Amazon, a common practice among threat actors leveraging cloud services to evade detection. The domain is flagged by 2 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and ScamSniffer. Additionally, the domain holds a trust score of 0/100, reinforcing its classification as malicious. Current status confirms the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the underlying threat remains active, as similar domains may emerge using comparable tactics. Organizations and users are advised to block the domain and its associated IP (3.160.150.3) at the network level. Security teams should monitor for related indicators of compromise, including WebAssembly-based payloads and Amazon CloudFront distributions linked to this infrastructure. Proactive measures include updating endpoint protection rules to detect phishing attempts and conducting retrospective log analysis for prior connections to this domain.